CVE-2025-10718

MEDIUM

Ooma Office Business Phone App <7.2.2 - Info Disclosure

Title source: llm

Description

A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

[Permissions Required, VDB Entry] https://vuldb.com/?id.325009

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.325009

[Permissions Required, VDB Entry] https://vuldb.com/?submit.645012

[Various Sources] https://github.com/KMov-g/androidapps/blob/main/com.ooma.office2.md

View Writeup ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0001

EPSS Percentile 3.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-926

Status published

Products (3)

Ooma/Office Business Phone App 7.2.0

Ooma/Office Business Phone App 7.2.1

Ooma/Office Business Phone App 7.2.2

Published Sep 19, 2025

Tracked Since Feb 18, 2026